CVE-2026-39581: 
WordPress vulnerability analysis and mitigation

CVE-2026-39581 is a SQL Injection vulnerability in the WP Sessions Time Monitoring Full Automatic WordPress plugin (also identified as activitytime) affecting versions 1.1.4 and earlier. It allows authenticated users with subscriber-level privileges to execute arbitrary SQL queries against the WordPress database. The vulnerability was reported by researcher hivesec on February 20, 2026, published by Patchstack on April 20, 2026, and disclosed to the NVD on June 16, 2026. It carries a CVSS v3.1 base score of 8.5 (High) (Patchstack, GitHub Advisory).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the plugin fails to properly sanitize or parameterize user-supplied input before incorporating it into SQL queries. An attacker authenticated with only subscriber-level privileges — the lowest default WordPress role — can craft malicious requests that manipulate the underlying SQL command, enabling arbitrary database reads. No user interaction is required, and the attack is network-accessible with low complexity, making it straightforward to exploit. The scope is marked as "Changed," indicating the impact extends beyond the vulnerable component itself (Patchstack, GitHub Advisory).

Successful exploitation allows an authenticated subscriber to read arbitrary data from the WordPress database, potentially exposing user credentials (including hashed passwords), personal information, session tokens, and other confidential records stored across all database tables. The confidentiality impact is rated High, while integrity is unaffected and availability impact is Low. In a WordPress context, access to credential hashes could enable offline cracking and subsequent account takeover, including administrator accounts, facilitating full site compromise (Patchstack, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the WP Sessions Time Monitoring Full Automatic plugin version 1.1.4 or earlier using tools like WPScan, Shodan, or by checking the plugin's readme.txt file at wp-content/plugins/activitytime/readme.txt.
2. Obtain subscriber access: Register a subscriber account on the target WordPress site (if open registration is enabled) or use compromised low-privilege credentials.
3. Identify the vulnerable endpoint: Locate the plugin's functionality that processes user-controlled input and passes it to database queries — typically a REST API endpoint, admin-ajax handler, or shortcode parameter exposed to authenticated users.
4. Craft SQL injection payload: Inject SQL syntax (e.g., UNION-based or time-based blind injection) into the vulnerable parameter to enumerate database tables and extract data such as wp_users (usernames and password hashes).
5. Extract sensitive data: Use the injected query to retrieve WordPress user credentials, email addresses, session tokens, or other sensitive records from the database.
6. Escalate access: Crack extracted password hashes offline (e.g., using Hashcat) to obtain plaintext credentials, then log in as an administrator to achieve full site control (Patchstack).

• Network: Unusual or repeated HTTP requests to WordPress AJAX endpoints (/wp-admin/admin-ajax.php) or REST API routes associated with the activitytime plugin, containing SQL metacharacters (', ", --, UNION, SELECT, OR 1=1) in parameter values.
• Logs: WordPress access logs showing requests from a single subscriber-level user account with abnormal frequency or payloads containing SQL keywords; PHP error logs referencing database query failures or unexpected SQL syntax errors from the plugin.
• Database: Unexpected or high-volume database queries originating from the plugin's context; queries accessing wp_users, wp_usermeta, or other sensitive tables outside normal plugin operation.
• File System: Presence of web shells or unauthorized files in wp-content/plugins/activitytime/ if post-exploitation activity occurred.
• User Activity: Subscriber accounts performing actions inconsistent with their role, or new administrator accounts created shortly after subscriber login activity (Patchstack).

The vendor has released version 1.1.5 of the WP Sessions Time Monitoring Full Automatic plugin, which patches this vulnerability — all users should update immediately (Patchstack). As interim mitigations, site administrators should restrict subscriber role registration if not required, and deploy a Web Application Firewall (WAF) with SQL injection detection rules. Patchstack users benefit from a virtual patch (mitigation rule) that blocks exploitation attempts without requiring an immediate plugin update. Database access logs should be monitored for anomalous query patterns.

Patchstack, which coordinated the disclosure, classified this vulnerability as high priority and noted that SQL injection vulnerabilities of this type are commonly leveraged in mass-exploit campaigns against WordPress sites (Patchstack). The vulnerability was also referenced in Wordfence's weekly WordPress vulnerability report for the week of April 20–26, 2026, indicating broad coverage within the WordPress security community. No significant social media controversy or vendor dispute has been noted.